Skip to Content

FaceTime for Mac security hole easily remedied

by Dave Caolo Oct 21st 2010 at 1:00PM

Macworld Germany has described what they're calling a security hole in the FaceTime for Mac beta (Google translation). The gist is this: once a user has logged into FaceTime for the Mac, his/her Apple ID and password can be altered from the app by anyone with access to the computer while FaceTime is running.

Let that sink in for a second.

If you were to log into FaceTime for Mac and then abandon your computer with everything running and no concern for who has access to it and for how long, there's a possibility that a n'er-do-well could sit down in your empty but still warm chair and engage in a scandulous conversation with your poor Aunt Shirley (who undoubtedly is wondering why you'd be dumb enough to walk away from your operational Mac in public) before changing your password and making several pricey purchases in iTunes.

In related security news, cash registers left unattended with their drawers open are likely to be robbed and cars left running with the doors unlocked are likey to be stolen. As Ars notes, "...whoever happens to be sitting at the computer can change the associated account password."

In the interest of our readers' safety, here are a few steps we suggest you take:
  • Don't go to the bathroom while FaceTime is running on your Mac at Starbucks. Hell, don't leave your Mac on a table at Starbucks no matter what it's doing.
  • Don't run FaceTime on a public computer.
  • If the "office prankster" asks to use your FaceTime account to make a call, SAY NO.
  • Think. Physical access is total access.
The takeaway here is this: any miscreant who has physical access to your computer is a potential security threat.

View Tags

Related Stories

Categories

Apple

Macworld Germany has described what they're calling a security hole in the FaceTime for Mac beta (Google translation). The gist is this:...
 

Add a Comment

Sign in »
*0 / 3000 Character Maximum Comment Moderation Enabled. Your comment will appear after it is cleared by an editor.

21 Comments

Filter by:
Tobias Fredriksson

This seems to have been taken care of already.

Whenever I press account and then show account it just goes back to the "account" screen in settings where I can add e-mail addresses.

October 21 2010 at 11:49 PM Report abuse rate up rate down Reply
totoro

Someone else with access to my computer? Facetime and my iTunes account is the least of my worries.

October 21 2010 at 4:06 PM Report abuse rate up rate down Reply
ilo.vekdl

That being said, they should still fix it. A layered defense is best.

October 21 2010 at 3:06 PM Report abuse rate up rate down Reply
Korpil

But anyway, this IS a major security hole. Any password change MUST ask for the previous password as confirmation.

Beta or not, it's a huge problem.

October 21 2010 at 2:02 PM Report abuse rate up rate down Reply
Korpil

I'm unable to reproduce this... whenever I click on "See account", it opens the Account window, but it's completely blank, and then goes back to the previous menu...

October 21 2010 at 2:00 PM Report abuse rate up rate down Reply
Max

If you are in Italy, well....

1. don't worry there is no Starbucks..
2. If there were Starbucks, with free internet connection, the place would be rammed with people trying to steal the connection and there would be no free seats, so no risk for your e-credentials.
3. If you were lucky enough to find a seat and Facetime someone oversea, and you suddenly had the need to go empty your blatter (or worse) and you left your laptop, open at the table, then... I am sorry.... but you deserve to "loose" your credentials...
4. If you are lucky enough, you won't need your Apple credentials anymore. Because you laptop would have a brand new owner :-)
5. I am Italian and I am allowed to make jokes on my country. If you try to be sarchastic on this, I will send my friends to you with "an offer you can't refuse..."

October 21 2010 at 1:45 PM Report abuse rate up rate down Reply
Shunnabunich

Cash register drawers can be closed, and car doors locked. In fact, that is the default state of those objects when operated by anyone not suffering from debilitating memory or cognitive impairment. FaceTime for Mac, at least until this security hole is closed, doesn't share that benefit.

October 21 2010 at 1:40 PM Report abuse rate up rate down Reply
1 reply to Shunnabunich's comment
TheCastro

Actually by your own admission to what the writer said, computers can be locked. Or logged out of. So FaceTime has the same benefit as cash in a drawer or radios in cars.

October 21 2010 at 4:01 PM Report abuse rate up rate down Reply
Donn

I can see both sides. I mean, duh, if you are computing in an untrustworthy environment, you shouldn't leave your computer unlocked, period, let alone worry about what app might be running. I lock my computer every time I leave my desk at work, and this is at a government office with highly vetted employees.

Best advice so far is to not associate your FaceTime ID with your iTunes ID, though you would think this to be logical, and the intent.

Still, I'm sure this oversight will be corrected shortly.

October 21 2010 at 1:40 PM Report abuse rate up rate down Reply
Rus Rasmussen

Thanks for the laugh. I actually laughed out loud to the surprise of a couple of co-workers passing by.

October 21 2010 at 1:34 PM Report abuse rate up rate down Reply
Joe RIckerby

Seems like you're being a little protective of Apple here, TUAW! Truth be told, this is quite a security hole. It's fair enough to say that physical access is total access, yes, access to the computer and it's data.

But ordinarily, data not on the computer (files on your iDisk, card details in your iTunes account settings) does not apply to this rule.

October 21 2010 at 1:27 PM Report abuse rate up rate down Reply
Buy an ad here

Hot Apps on TUAW

Tweets

© 2012 AOL Inc. All Rights Reserved.